netdev - Re: [PATCH net-next] lwt: fix rx checksum setting for lwt devices tunneling over ipv6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 11 Feb 2016 13:16:52 +0100
From:	Jiri Benc <jbenc@...hat.com>
To:	Paolo Abeni <pabeni@...hat.com>
Cc:	netdev@...r.kernel.org, "David S. Miller" <davem@...emloft.net>,
	Pravin Shelar <pshelar@...ira.com>,
	Thomas Graf <tgraf@...g.ch>, Jesse Gross <jesse@...nel.org>
Subject: Re: [PATCH net-next] lwt: fix rx checksum setting for lwt devices
 tunneling over ipv6

On Thu, 11 Feb 2016 12:38:51 +0100, Paolo Abeni wrote:
> We are already sending by default zero UDP checksum when tunneling over
> vxlan/geneve light weight tunnel since the commit 35e2d1152b22
> ("tunnels: Allow IPv6 UDP checksums to be correctly controlled.").
> 
> Currently, geneve/vxlan lwt pairs tunneling over ipv6 are not able to
> talk each-other with default setting since the sender will set zero UDP
> checksum in the external header and the receiver will discard such
> packets.
> 
> This commit is intended to address the above issue.
> 
> Such issue could be addressed also by defaulting all lwt geneve/vxlan
> flows (comprising those tunneling over ipv4) to set the external UDP
> checksum, but a single lwt tunnel device can be used to terminate flows
> with different checksum settings.

Hmm, right. The checksumming in tx path is solely controlled by
TUNNEL_CSUM value in tun_flags and openvswitch does not set
OVS_TUNNEL_KEY_ATTR_CSUM by default.

This is another property that should have been per-interface and not
per-packet in metadata based mode :-/ But we cannot change it now.

We could probably provide a way for the ovs user space to control the
rx checksumming flag but as the tx flag can be set per-flow, it would
only lead to ovs allowing acceptance of zero rx checksums
unconditionally anyway.

I don't see a better way out of this now. Fortunately, this does not
affect route based tunneling.

Acked-by: Jiri Benc <jbenc@...hat.com>

We should follow up in ovs (user space) to set OVS_TUNNEL_KEY_ATTR_CSUM
by default, at least for IPv6.

 Jiri

-- 
Jiri Benc